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Significance for public health 

The article identifies lessons from previous theories of human error and 
accident causation, foresight, resilience engineering and system migration 
and introduces a new framework for understanding patient safety in health- 
care; the System Evolution, Erosion and Enhancement (SEEE) model. The 
article is significant for public health because healthcare organizations 
around the world need to understand how safety evolves and erodes to devel- 
op and implement interventions to reduce patient harm. 



leal error,2'^ including To error is human in the United States and an 
Organization with a Memory in the UK,^'^ have advocated that it is 
important to understand how healthcare systems fail, rather than sim- 
ply focusing on individual healthcare professionals who make errors. 
The article discusses previous models of accident causation,^'^ human 
error,^'^'^'^ foresight,^-^^ resilience engineering and system migra- 
tion.ii"^^ Five lessons from these previous theories are identified and 
a new framework for understanding safety is presented: the System 
Evolution Erosion and Enhancement (SEEE) model. 



Abstract 



The paper summarises previous theories of accident causation, 
human error, foresight, resilience and system migration. Five lessons 
from these theories are used as the foundation for a new model which 
describes how patient safety emerges in complex systems like health- 
care: the System Evolution Erosion and Enhancement model. It is con- 
cluded that to improve patient safety, healthcare organisations need to 
understand how system evolution both enhances and erodes patient 
safety. 



Background 

All too often, the response when a doctor, nurse or allied healthcare 
professional makes a mistake is to blame and punish. Healthcare pro- 
fessionals who make errors are often viewed as being careless, culpa- 
ble and are subject to disciplinary action.^ 

This approach, known as the person-centred approach to human 
error,^ commonly prevails in healthcare systems around the world. It 
does not improve patient safety. The person-centred model of human 
error is linked to two myths that we must eradicate if we want to make 
healthcare systems safer; the punishment myth and the perfection 
myth.^ The punishment myth relates to the belief that if we punish 
healthcare professionals who make mistakes they will be more careful 
in the future and make fewer errors.^ The perfection myth is the belief 
that if people try hard enough they will not make errors.^ It is based on 
the assumption that error-free performance is attainable and is some- 
thing doctors, nurses and allied healthcare professionals can achieve 
if they are more vigilant. Evidence from cognitive psychology and 
human factors research shows us that the expectation of error-free 
performance is unrealistic^-^ Human performance is shaped by the 
context in which it occurs; factors like task and process design, cul- 
ture, teamwork and environmental conditions all influence human 
performance.^'"^ 

Research on accident causation and landmark publications on med- 



The systems approach to accident causation 

The systems approach is encapsulated in Reason's Swiss Cheese 
model of accident causation.^-^ The model states that in any system 
there are many levels of defence but these defences are imperfect both 
because of inherent human fallibility and weaknesses in how systems 
are designed and operated. 

Reason's model distinguishes between active failures and latent 
conditions.^'^ Active failures are errors and violations that are commit- 
ted by people at the service delivery end of the healthcare system (e.g., 
the ward nurse, the pharmacist,, the general practitioner, the operat- 
ing room team, the psychiatric nurse etc.). Active failures by these 
people may have an immediate impact on safety. 

Latent conditions result from poor decisions made by the higher 
management in an organization, e.g. by regulators, governments, 
designers, and manufacturers. Latent conditions lead to weaknesses 
in the organization's defences, thus increasing the likelihood that 
when active failures occur they will combine with existing precondi- 
tions, breach the system's defences, and result in an organizational 
accident. Latent conditions and active failures lead to windows of 
opportunity in a system's defences. When these windows of opportuni- 
ty are aligned across several levels of a system, an accident trajectory 
is created (Figure 1). The accident trajectory is represented by the 
penetration of the levels of defence by an arrow. The holes represent 
latent and active failures that have breached successive levels of 
defence. When the arrow penetrates all the levels of defence, an 
adverse event (a death or patient harm) occurs.^-^ 



Swiss cheese and medical incident 
investigation 

Incident investigations based on the Swiss Cheese model identify 
how latent conditions and active errors combine to lead to patient 
harm. The latent conditions and active failures that have been identi- 
fied from investigations of intrathecal vincristine medication inci- 
dents in healthcare are summarised below.^'^-^"^ 
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Latent conditions: i) unclear or inaccessible chemotherapy policies 
and procedures. For example, policies where it was not made clear that 
intravenous vincristine and intrathecal methotrexate should not be 
given in the same clinical location on the same day. ii) A hierarchical 
organizational culture in which nurses and pharmacists felt unable to 
challenge the unsafe practice of consultants, iii) The design of spinal 
connectors (which allowed a vincristine syringe to be attached to a 
spinal connector), iv) Poor induction practices for junior doctors 
whereby doctors were allowed to circumvent the intrathecal medicine 
induction training because of production pressures on the ward, v) A 
culture characterized by convergence of benevolence where staff rou- 
tinely broke rules to meet patient needs and to ensure that treatment 
was administered as closely to chemotherapy protocols as possible.^ 

Active failures', i) checking errors by hospital pharmacists which 
allow vincristine to be sent to a clinical area at the same time 
methotrexate is scheduled to be administered to a patient; ii) checking 
omissions or failures by the junior doctors means that they do not iden- 
tify they are about to administer vincristine intrathecal^ (when it 
should only be administered intravenously). 



Beyond Swiss Cheese 

The Swiss Cheese model has been used as the theoretical basis for 
developing other models of incident causation (for example, 
Helmreich's threat and error management model in aviation) and inci- 
dent investigation tools in healthcare [ (for example, the London proto- 
col and Prevention Recovery Information System for Monitoring and 
Analysis (PRISMA)-Medical (PRISMA-Medical) ] .i^-i^ The distinction 
between active and latent failures has strongly influenced efforts to 
understand the causes of error and incident investigation for the last 
two decades, both in healthcare and other industries. Its dominance 
has prevailed even though Reason himself has developed newer mod- 
els aimed at understanding human error in complex systems. For 



example, the three buckets model and the harm absorbers model,^'^^ 
both which recognise that healthcare professionals often use intuition, 
expertise and foresight to anticipate, intervene and prevent patient 
harm.^'i^ In this sense, doctors, nurses and allied healthcare profes- 
sionals are the last line of defence in the healthcare system.^-^^ 



The old versus the new view of human error 

Some critics have argued that, although well-intentioned, in prac- 
tice, the Swiss Cheese Model, leads to a linear approach to incident 
investigation: in what has been termed the old view of human error, 
efforts are made to trace back from active errors to identify organisa- 
tional failures without recognising the complexity of systems like 
healthcare and aviation.^-^ 

Dekker distinguishes between the old view and the new view of 
human error.^-^ He argues that the old view of human error, where 
there is a search for organisational deficiencies or latent failures, sim- 
ply causes us to relocate the blame for incidents upstream to senior 
managers and regulators. This was recently evidenced in the United 
Kingdom National Health Service in the Francis Inquiry report into the 
deaths of patients at Mid Staffordshire hospital.^^ There was signifi- 
cant focus in both the inquiry report and in subsequent media coverage 
on the lapses by healthcare regulators that led to delays in intervening 
to prevent patients being harmed. As a result of the findings of the 
Francis Inquiry and other high profile national incident reports, the 
NHS's key regulator, the Care Quality Commission, has come under 
intense media scrutiny. Dekker's argument that blame is simply attrib- 
uted further upstream seems, to some extent, to have been borne out 
by Mid Staffordshire. 

Dekker advocates that a new view of human error is needed which 
views safety as an emergent property of a system in which there are 
numerous trade-offs between safety and other goals, (for example, pro- 
duction pressures). Other theorists have also recognised that safety 
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Figure 1. Swiss Cheese model of organizational accidents. 
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is an emergent property in complex systems, including proponents of 
resilience engineering.ii'^^ 



Resilience engineering 

Resilience is the ability of individuals, teams and organisations to 
identify, adapt and absorb variations and surprises on a moment by 
moment basis.^^ Resilience engineering recognises that complex sys- 
tems are dynamic and it is the ability of individuals, teams and organ- 
isations to adapt to system changes that creates safety Resilience 
moves the focus of learning about safety away from What went wrong? 
to Why does it go right?}'^ 

Case study examples of how healthcare teams create resilience in 
emergency departments and operating theatres have been published.^^"^^ 
For example, Patterson described how collaborative cross checking 
occurs in teams and that this is a resilience strategy used by teams to 
maintain safety^^ 

One key concept from resilience engineering is the distinction 
between Safety 1 and Safety 2P In healthcare, safety has traditionally 
been defined by its absence. That is to say, we learn how to improve 
safety from investigating past events like incidents, complaints. This is 
known as Safety I.^^ In contrast. Safety II focuses on the need to learn 
from what goes right. It involves exploring the ability to succeed when 
working conditions are dynamic.^^ Safety II involves looking at good 
outcomes, including how healthcare organisations adapt to drifts and 
disturbances from a safe state and correct them before an incident 
occurs. In healthcare, we rarely learn from what goes right because 
resources are solely invested into learning from what goes wrong. 
However, serious incidents occur less frequently than instances of 
Safety II (which are numerous).^^ Hence focusing on what goes right 
would provide an opportunity to about events that occur frequently, as 
opposed to rarely. 



Migration to system safety boundaries 

Amalberti's system migration model is also relevant to understand- 
ing medical errors in healthcare.^^ Amalberti postulates that humans 



are naturally adaptable and explore their safety boundaries. A combina- 
tion of life pressures, perceived vulnerability, belief systems and the 
trade-off between these factors versus perceived individual benefits 
leads people to navigate through the safety space: 

Amalberti differentiates between:^^ i) the legal space, i.e. prescribed 
behaviour; ii) the illegal-normal space, where people naturally drift 
into depending on situational factors and personal beliefs; iii) the ille- 
gal-illegal space; which brings people into an area of that is unsafe and 
where the probability of an accident occurring is greatly increased. 

In healthcare, the legal-space is defined by policies, procedures and 
guidelines that describe standards of safe practice. Frequently, when 
serious incidents occur, non-compliance with policies and procedures 
is identified as a root cause. All too often hindsight bias comes into play 
in the investigation process and too little consideration is given to the 
situational factors that led to non-compliance. Hindsight bias occurs 
when an investigator,^^ who is looking backwards after an incident has 
occurred, judges the behaviour of those involved unfairly because with 
the benefit of hindsight it is easy to see the alternative courses of 
action that could have been taken which would prevent the incident 
from occurring. 

In one study exploring procedural non-compliance in healthcare, a 
ward sister who had been disciplined following a drug error that led to 
serious harm to a patient was interviewed.^^ The hospital had recently 
amended its Medication policy for the drug involved in the incident, 
reverting back to a double-checking procedure from single checking by 
a nurse prior to medication administration. The ward sister was 
unaware the Medication policy had been changed and did not involve 
another nurse in the checking process before administering the drug 
to the patient. As a result, she was disciplined, partly because hindsight 
and outcome bias in the incident investigation process meant that the 
lead investigator did not look into how the changes to the medication 
policy was communicated to nursing staff and whether other nurses 
were unaware of the changes to the checking procedure.^^ 



Five lessons about safety and accident 
causation 

Table 1 summarises five lessons from the theories that have been 
summarised in the article. It is postulated that future theories of safe- 



Table 1. Five key lessons from previous theories of accident causation, human error, foresight, resilience and system migration. 



IWhat is the lesson to learn? 


Source 1 


Lesson 1: a combination of systems and human factors can enhance or erode safety. 


Swiss Cheese, Three buckets and harm absorber models 


Lesson 2: systems are dynamic: they evolve over time and spring nasty surprises. 
Healthcare professionals, teams and organisations sometimes successfully anticipate 
and manage these nasty surprises, and sometimes they do not. 


Three buckets and harm absorber models; 
Resilience engineering; Safety 1 versus Safety 2 


Lesson 3: safety is an emergent property of the system which needs to be understood 
in the context of trade-offs with other competing goals 
(for example, in healthcare, meeting efficiency targets, making financial savings 
and ensuring continuity of the service). 

Lesson 4: hindsight bias, together with the human tendency to attribute blame 
and the fact that serious incidents occur less frequently than successful outcomes 
limits what we can learn from taking human error as our starting point and tracing 
backwards to identify the causes of what went wrong. We therefore need to balance 
our focus and learn from what goes right rather than being preoccupied 
with learning from what goes wrong. 


The old and new view of human error; Resilience engineering 
The old and new view of human error; Safety 1 versus Safety 2 


Lesson 5: humans migrate and explore the system's safety boundaries. 
The extent to which they do this depends upon a combination of factors 
including life pressures, situational factors and personal belief systems. 


System migration 
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ty need to take account of these five lessons in order to develop models 
and frameworks that capture the complexity of safety in healthcare. 
Without an under-pinning theoretical framework that captures how 
safety is a complex, dynamic phenomenon, healthcare organisations 
around the world will not understand the different facets of safety that 
emerge as healthcare systems evolve over time. 



The Safety Evolution Erosion and 
Enhancement model 

The five lessons summarised in Table 1 are illustrated in Figure 2. 
Figure 2 shows the underlying processes that healthcare organisations 
need to appreciate to understand safety as a complex, dynamic process. 
It shows how system evolution impacts on safety both positively and 
negatively by causing both erosion and enhancement. Figure 2 shows 
that both systems-level, team and individual human factors can 
enhance or erode safety in healthcare (i.e. Lesson 1). Figure 2 aims to 
show that any system, whether it is a healthcare system, aviation, off- 
shore oil and gas, banking or other complex sociotechnical system nat- 
urally evolves over time (i.e. Lesson 2). System evolution is caused by 
many different types of factors including the introduction of new tech- 
nology, innovations in healthcare procedures, organisational restruc- 
turing or mergers, staff retention and recruitment, patient pathway and 
process re-design, the context and focus of external regulators, cultur- 
al change, equipment maintenance and IT upgrades, production, effi- 
ciency and safety performance targets, and the economic climate. 
System evolution also occurs as a result of the natural human tenden- 
cy to explore safety boundaries (i.e. Lesson 5) (Figure 2). 



Enhancement and erosion 

System evolution can have both positive and negative effects on 
safety. In terms of positive effects, system evolution can lead to safety 
enhancement. Enhancement occurs when system evolution strength- 
ens in-built defences, barriers and safeguards or where it improves the 
ability of individuals and teams to anticipate and respond when nasty 
surprises occur. By recognising that safety enhancement results from 
system evolution. Figure 2 illustrates the importance for healthcare 
organisations of learning from what goes right (i.e. Safety II; HoUnagel 
2012; i.e. Lesson 4), rather than only learning from what goes wrong. 

System evolution can also lead to erosion, where defences, barriers 
and safeguards are weakened or where the ability of teams and individ- 
uals to identify, intervene and thwart emerging safety threats is nega- 
tively affected (Figure 2). 

The central tenet of the SEEE model is that in order to effectively 
manage safety, healthcare organisations need to understand the rela- 
tionship between system evolution and enhancement and erosion. 
Hence we need to recognise that safety is an emergent property of the 
system and that it needs to be understood in context of how it is bal- 
anced against other competing goals like production and efficiency tar- 
gets (i.e. Lesson 3). 

All too often, as other authors have previously stated, healthcare 
organisations carry out a forensic analysis of what went wrong after an 
incident occurred.^-^-^^-^^ As shown in Figure 2, this is equivalent to try- 
ing to understand and improve safety by looking through a microscope 
whose lens is focused on understanding safety erosions in isolation. As 
other authors have previously stated, this type of approach means we 
miss opportunities to learn from what goes right.^^ Another way of 
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Figure 2. The processes of safety evolution, erosion and enhancement. 
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understanding this problem is with reference to the recent measuring 
and monitoring safety framework developed by Vincent, Burnett and 
Carthey.^"^ The measurement framework (Figure 3) comprises five 
dimensions, all of which are important for the effective monitoring and 
management of safety: i) Past harm: has patient care been safe in the 
past? This involves assessing rates of past harm to patients, both phys- 
ical and psychological, ii) Reliability: are our clinical systems, process- 
es and behaviour reliable? This is the reliability of processes and sys- 
tems in organisations but also the capacity of the staff to follow safety 
critical procedures, iii) Sensitivity to operations: is care safe today? 
This is the information and capacity to monitor safety on an hourly or 
daily basis. We refer to this as sensitivity to operations. \\) Anticipation 



and preparedness: will care be safe in the future? This refers to the abil- 
ity to anticipate, and be prepared for, threats to safety V) Integration 
and learning: are we responding and improving? The capacity of an 
organisation to respond, assimilate, learn and improve from, safety 
information. 

Healthcare organisations who only focus on learning about system 
erosion invest time and resources learning from past harm and some 
elements of reliability without paying sufficient attention to the other 
dimensions of the measurement and monitoring framework {i.e. sensi- 
tivity to operations, anticipation and preparedness, integration and 
learning). 
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Figure 3. Measurement and monitoring of safety framework. 




Figure 4. The System Evolution, Erosion and Enhancement 
model of safety. 



Understanding safety emergence 

The SEEE model is shown in Figure 4. Figure 4 shows how system 
evolution leads to both erosion and enhancement. Importantly, it also 
shows the zone of safety emergence. This is the area where positive 
and negative effects of system evolutions need to be anticipated and 
understood in order to manage safety effectively The SEEE model pos- 
tulates that how well healthcare organisations manage safety critically 
depends on their ability to anticipate and understand emerging ero- 
sions and enhancements to safety that occur as the healthcare system 
evolves. Rather than using the old view of error to learn safety lessons, 
we need to develop methods that provide insights into the relationship 
between system evolution, erosion and enhancement. Most important- 
ly, future methods to learn and improve safety need to focus on what is 
happening in the zone of safety emergence, rather than retrospective- 
ly trying to learn after incidents have occurred. This approach all too 
often leads to an exclusive focus on the process of erosion. 



Conclusions 

To improve patient safety, there is a need to learn lessons from past 
theories of accident causation, human error, foresight, resilience and 
system migration and to develop theoretical models which describe 
safety as a complex, multi-faceted and dynamic phenomenon. By devel- 
oping an under-pinning theoretical framework that captures the com- 
plexity of safety evolution, erosion and enhancements, healthcare 
organizations around the world can be educated and supported to 
understand the true complexity of monitoring and measuring patient 
safety. 
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